Location Disservices? Protecting against the Inherent Cybersecurity Risks of Geotagging

In this political season, much has been made about late-night Twitter rants targeting women and other social media attacks on individuals and celebrities. Although these harsh online critiques create a more hostile cyber community, more imminent danger may arise from the safety risks that accompany online activity in general. Law-enforcement officials have long warned users against disclosing travel plans on social media to would-be thieves by, for example, posting pictures of a boarding pass from that long-awaited trip to Barcelona. But what about apps and services like Find My Friends, where users can share their location with up to 50 friends, or Snapchat, which shows a user’s location when posting an image or video? With a culture focused on sharing and instant access to information via social media feeds, it bears considering if location-revealing apps engender some inherent danger, whether the app developers disclose potential risks, and what steps can be taken to protect personal safety.

Keeping Tabs on a Kardashian
Just last week, a group of armed, masked men broke into Kim Kardashian West’s apartment in Paris, tied her up in the bathroom, and robbed her. The men reportedly made off with $10 million in jewelry and other personal items. There is rampant speculation that the robbers located Kardashian West through her Snapchat account. In the days proceeding—up to just hours before the robbery—Kardashian West posted snaps from her Paris apartment. Although Snapchat stories auto-delete after 24 hours, Kardashian West has hordes of fan accounts devoted to saving and reposting her snaps. She is also highly active on Instagram and Twitter, and travels with an entourage of people tending to her on-screen image—a cadre of hair, makeup, and wardrobe stylists—all of whom also freely post about the celebrity. The combination of Kardashian West’s own extensive social media activity, fan posts, and posts by her traveling entourage would allow motivated thieves to track her activities, pinpoint her locale, and plan and execute an attack—all from their mobile devices.

Kardashian West’s frightening ordeal raises the issue of whether apps are creating opportunities for criminals willing to devote time to researching social media accounts, and whether users need to be savvier about the way they are using apps.

Some apps allow users to choose when a post receives a geolocating stamp. Instagram, for example, allows users to determine if and when to geotag a post. Find My Friends allows users to select the group of friends who can access the user’s location; turn off location broadcasting services for one friend in particular; or turn off the service completely. In a nod towards personal safety and privacy, the Find My Friends disclosures indicate that “[y]our location is sent from your device only when someone requests to see it. Your location isn’t transmitted on a regular interval.” For Instagram, Find My Friends and other apps that provide a geotagging option, turning this feature off or selectively using geotagging options may help protect personal safety.

Snapchat also allows users to choose what posts to geotag, but because so many of the most desirable features of the app require users to turn on location services, users commonly geotag their posts. Snapchat’s Terms of Service (TOS) do not refer to the potential dangers of geotagging but do require users to agree to help Snapchat keep its services safe by not using the services for illegal purposes:

8. Safety

We try hard to keep our Services a safe place for all users. But we can’t guarantee it. That’s where you come in. By using the Services, you agree that:

• You will not use the Services for any purpose that is illegal or prohibited in these Terms.

Anyone using Snapchat for the purpose of stalking and robbing other users are clearly violating the TOS.

Snapchat also broadly disclaims liability for use of its services, including asserting that the services are provided “as is,” without any warranties. Snapchat further indicates that the platform does not represent that the services will be “secure” and disclaims all liability arising out of content the user supplies:

15. Disclaimers

…

SNAP INC. TAKES NO RESPONSIBILITY AND ASSUMES NO LIABILITY FOR ANY CONTENT THAT YOU, ANOTHER USER, OR A THIRD PARTY CREATES, UPLOADS, POSTS, [OR] SENDS …

The TOS further provides:

16. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SNAP INC. … WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR MULTIPLE DAMAGES, … OR ANY LOSS OF DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM: (A) YOUR ACCESS TO OR USE OF OR INABILITY TO ACCESS OR USE THE SERVICES; (B) THE CONDUCT OR CONTENT OF OTHER USERS OR THIRD PARTIES ON OR THROUGH THE SERVICES …

Because the Snapchat TOS makes clear that the user bears the responsibility for any damage or harm resulting from use of the service, even were another Kardashian West-style robbery to take place that could be directly linked to the criminals locating their victim through the platform, it likely would be difficult for an injured user to seek recourse against Snapchat. As we have written previously, a good TOS clearly outlining user responsibilities and limiting liability is a requirement for all social media platforms. Recent events demonstrate that a good TOS should also include plain disclosures about the use of a service’s geotagging features.

Some ways to mask one’s location on Snapchat include forgoing use of the more popular filters and Our Story features, avoiding the use of the app altogether, or doing what Khloe Kardashian does—use the app in Airplane Mode while shooting video clips and upload them after leaving a venue. Users concerned about individual safety need to be cautious about intentionally or inadvertently disclosing their location. After all, while we are living in the age of social media, we have to remember criminals are, too.